When I execute the following for a fixed database role:

EXEC sp_dbfixedrolepermission 'db_denydatawriter'

the resultset is as follows:

db_denydatawriter No DELETE permission on any object
db_denydatawriter No INSERT permission on any object
db_denydatawriter No UPDATE permission on any object

Similarly, I'd like to create a database role that allows SELECT, INSERT,
and UPDATE, but prevents DELETE permission, on any object in a database.

From my interpretation of BOL, it appears that I can't use GRANT or DENY to
apply globally within a database ("on any object"), but I'm required to
specify the individual object I wish to carry out a GRANT or DENY.

Currently, the catch is that I need to create this in a newly created
database that currently contains no database objects at all, and that I'd
like the custom db role that I'm creating to be automatically applied to any
objects created in the future.

Is there a way to create or to customize a database role, with global
attributes on everything in a database?

Thanks in advance for your help.

- H -